[原文]The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.
Ubuntu Security Notice USN-198-1 - Javier Fernandez-Sanguino Pena discovered that several tools in the cfengine package (vicf, cfmailfilter, and cfcron) create and use temporary files in an insecure way. A local attacker could exploit this with a symlink attack to create or overwrite arbitrary files with the privileges of the user running the cfengine program.
Ubuntu Security Notice USN-198-1 October 10, 2005
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
The problem can be corrected by upgrading the affected package to
version 1.6.5-1ubuntu0.4.10.1 (for Ubuntu 4.10), or
1.6.5-1ubuntu0.5.04.1 (for Ubuntu 5.04). In general, a standard
system upgrade is sufficient to effect the necessary changes.